CVE-2026-123333

LowCVSS 3.8/10Last modified Nov 6, 2026

Description

In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsYouTrack< 2026.2.19562

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233343.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another projectCVE-2026-1233353.5In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the CVE-2026-1233363.1In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversionCVE-2026-1233373.1In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibilityCVE-2026-123338Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source canCVE-2026-1233392.3Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to CVE-2026-1233415.4Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convinCVE-2026-1233567.5GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTrainCVE-2026-1233570.0GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversionCVE-2026-1233642.4OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crCVE-2026-1233677.4Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate CVE-2026-1233682.3compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, co
CVE-2026-123333: Low severity, CVSS 3.8 | Vulnix